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Treasury's Office of Foreign Assets Control (OFAC) is charged with enforcing a range of economic sanctions 
programs in connection with which it has taken recent enforcement actions involving staggering amounts of 
civil money penalties. This has raised questions as to how OFAC confronts apparent violations and deals 
with the myriad types of companies and financial institutions that must comply with economic sanctions. 
OFAC's sanctions regulations prohibit or regulate transactions with, and order the blocking of property of 
certain foreign nations, persons, or entities identified as threatening the national security of the United 
States. Sanctions are imposed pursuant to specific statute or by Presidential Executive Order issued under 
the International Emergency Economic Powers Act of 1977 (IEEPA) . 

Recent OFAC penalties, e.g., almost $1 billion against BNP Paribas for violating Sudanese, Iranian, and 
Cuban sanctions; and almost $17 million against Bank of America for violations of the Foreign Narcotics 
Kingpin Sanctions Regulations , were calculated on the basis of OFAC's Economic Sanctions Enforcement 
Guidelines (Guidelines). These Guidelines provide an insight into what OFAC expects of compliance 
programs. Familiarization with them can provide a roadmap for companies and financial institutions on how 
to interact with OFAC and to blunt the possibility of massive penalties when confronting an apparent 
violation of one of the economic sanction programs. 

Some sanctions are directed at specific countries, e.g., Cuba and Iran . Others aim to further limited U.S. 
foreign policy objectives, e.g., eliminating trade in conflict diamonds . Still others target various kinds of 
corruption and terrorism. Many of the sanctions are based on Executive Orders issued under authority of 
IEEPA. Some, such as the Foreign Narcotics Kingpin Designation Act (Kingpin Act), are derived from a 
specific statute; others, such as Counter Terrorism Sanctions and Counter Narcotics Sanctions rely on a 
combination of Executive Orders and specific statute 

Under IEEPA, once the President has declared a national emergency with respect to a threat "to the 
national security, foreign policy, or economy of the United States" from a source "in whole or in substantial 
part outside the United States," broad authority is available to impose an economic embargo over 
transactions and property in which a foreign nation or foreign person has an interest. Pursuant to this 
authority, after the President has issued an Executive Order regulating or prohibiting transactions involving 
property or interests in property of specific foreign countries, entities, or individuals, OFAC will issue 
implementing regulations. Generally, these regulations will identify with specificity the sanctioned parties 
and the types of transactions and property interests covered. The regulations will often include procedures 
for obtaining licenses to engage in certain transactions, to challenge the applicability of the regulations, or 
to seek to be delisted from OFAC's Specially Designated Nationals List fSDN List), naming hundreds of 
specially designated individuals and companies whose assets are blocked. 

According to the Guidelines, a company's compliance program and the specific factual circumstances giving 
rise to a sanctions violation are among the principal factors that OFAC considers in determining the course 
of an enforcement action. If the business, itself, uncovered the violation, how it reacted will be important 
as will whether it reported the violation. In any case, cooperation with OFAC will be considered a mitigating 
factor. The Guidelines provide a Risk Matrix that businesses and financial institutions may use to assess the 
general degree of risk posed by their activities and establish a compliance program tailored to whether their 
risks are low, moderate, or high. In making this determination, businesses are to consider: whether their 
customer base is stable or fluctuating; whether their business deals locally or internationally; and, whether 
there are frequent international funds transfers, multiple foreign correspondent accounts; foreign branches, 



or other international transactions. Other factors that may be important are whether there is a large array 
of electronic products and services and how much the firm's management is involved in assessing the risks, 
keeping abreast of OFAC developments, assigning responsibilities, and assuring adequate staffing and 
training. 

When OFAC becomes aware of an apparent violation, it determines what type of enforcement action is 
appropriate after considering a number of factors provided in the Guidelines. There is no indication of the 
weight OFAC gives to each factor or the extent to which any one of the factors or combination of factors 
would moot an enforcement action or require a specific action. What the Guidelines pinpoint, however, is 
that OFAC looks kindly on self-reporting, cooperation, and good faith efforts at compliance. 

The list of potential enforcement actions includes license denial, revocation, or suspension; cease and desist 
order; civil money penalty; and criminal referral. After investigating an apparent violation, OFAC has several 
options: (1) taking no action and, if the subject is aware of the OFAC investigation, notifying the subject; 

(2) seeking more information either by issuing an administrative subpoena or working through the entity's 
federal regulator; (3) issuing a cautionary letter urging improved compliance-indicating that OFAC has 
failed to sufficiently establish a violation; (4) issuing a Finding of Violation— indicating a problem that does 
not rise to a level that calls for a civil penalty but requires steps to improve compliance; (5) imposing a civil 
money penalty; and (6) making a criminal referral (either with or without imposing a civil money penalty). 

In determining which of these actions to take, OFAC considers a number of factors in mitigation of the 
offense. The enforcement decision may be influenced by the extent to which the conduct was willful or 
reckless; the degree of management culpability; the level of harm to the policy objectives of the sanctions 
program; or the potential effect of deterring further violations. Moreover, OFAC may make allowances for 
individual characteristics of the violator, such as relative unsophistication. It is also likely that OFAC will 
consider the volume of violations; the quality of the compliance program; and, whether there was 
cooperation by self-disclosing or agreeing to toll any statute of limitations. If civil penalties are in order, the 
Guidance includes a schedule that ranges from $1,000 to $250,000. This schedule, of course, could be 
supplanted by any applicable statutory penalty. IEEPA, for example, provides for a maximum penalty of the 
greater of $250,000 or twice the amount of the transactions. Under the Kingpin Act, the maximum penalty 
is $1,000,000. Other statutes, such as the United Nations Participation Act ($10,000), set lower maximum 
penalties. 

When OFAC has determined that a civil money penalty is appropriate, it will issue a Pre-Penalty Notice 
specifying details of the purported violation and proposed amount of the penalty and offer the subject an 
opportunity to respond. In calculating the base penalty, OFAC makes a distinction between egregious and 
non-egregious cases with emphasis on factors such as the extent to which the conduct is a willful or 
reckless violation of law committed with a high level of awareness of the conduct violating the law or 
regulation. Only OFAC's Director or Deputy Director may determine an offense to be egregious. Voluntary 
self-disclosure of either type of conduct— egregious or non-egregious— will result in cutting the applicable 
penalty by one half. 
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